IP Library › Granted Patent US 12682103
Granted Patent B2
US 12682103 · App. 18/496,416 · Granted Jul 14, 2026

User-specific access control for metadata tables

Inventor: Yinghua Ouyang (Xi'an, CN)
Assignee: SAP SE
G06F21/6227
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12682103
App. No.
18/496,416
Granted
Jul 14, 2026
Kind
B2
Abstract

The present disclosure involves systems, software, and computer implemented methods for user-specific access control for metadata tables. An example method includes receiving, from a user, a query that queries a metadata table. For each metadata table row, a determination is made as to whether the user owns the object represented by the metadata table row. If the user owns the object, the row is included in a result set for the query. If the user does not own the object, a determination is made as to whether the user has access permission to the object. If the user has access permission to the object, the row is included in the result set. If the user does not have access permission to the object, the row is excluded from the result set. After all metadata tables rows are processed, the result set is provided in response to the query.

Claims (43)

1 . A computer-implemented method comprising:

receiving, from a user, a query that queries a system metadata table of a database system that includes database system metadata about database catalog objects created by users of the database system, wherein the system metadata table is created with a corresponding table definition defining columns included in the system metadata table and wherein the corresponding table definition includes column names of columns, data types of the column names, and length values indicating sizes of the data types;

processing rows of the system metadata table in response to the query, wherein processing a respective row of the rows of the system metadata table comprises:

determining a database catalog object represented by the respective row of the system metadata table;

determining if the user owns the database catalog object represented by the respective row of the system metadata table using table authorization information;

in response to determining that the user owns the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in a result set for the query;

in response to determining that the user does not own the database catalog object represented by the respective row of the system metadata table, determining whether the user has access permission to the database catalog object represented by the respective row of the system metadata table;

in response to determining that the user has access permission to the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in the result set for the query; and

in response to determining that the user does not have access permission to the database catalog object represented by the respective row of the system metadata table, excluding the respective row of the system metadata table from the result set for the query; and

providing, to the user, the result set in response to the query.

2 . The computer-implemented method of claim 1 , wherein the system metadata table stores metadata about database catalog object types of tables, views, stored procedures, functions, or indices.

3 . The computer-implemented method of claim 1 , wherein the query is received from a process associated with the user.

4 . The computer-implemented method of claim 3 , wherein the result set is provided to the process.

5 . The computer-implemented method of claim 1 , wherein a first row of the system metadata table is included in the result set based on the user owning a database catalog object represented by the first row of the system metadata table.

6 . The computer-implemented method of claim 5 , wherein the first row of the system metadata table is included in the result set based on the first row of the system metadata table also matching a query condition included in the query.

7 . The computer-implemented method of claim 1 , wherein a second row of the system metadata table is included in the result set based on the user having access permission to a database catalog object represented by the second row of the system metadata table.

8 . The computer-implemented method of claim 1 , wherein a third row of the system metadata table is not included in the result set based on the user not owning a database catalog object represented by the third row of the system metadata table and the user not having access permission to the database catalog object represented by the third row of the system metadata table.

9 . The computer-implemented method of claim 1 , wherein a user who owns a database catalog object is the user who creates the database catalog object.

10 . A system comprising:

one or more computers; and

a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:

receiving, from a user, a query that queries a system metadata table of a database system that includes database system metadata about database catalog objects created by users of the database system, wherein the system metadata table is created with a corresponding table definition defining columns included in the system metadata table and wherein the corresponding table definition includes column names of columns, data types of the column names, and length values indicating sizes of the data types;

processing rows of the system metadata table in response to the query, wherein processing a respective row of the rows of the system metadata table comprises:

determining a database catalog object represented by the respective row of the system metadata table;

determining if the user owns the database catalog object represented by the respective row of the system metadata table using table authorization information;

in response to determining that the user owns the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in a result set for the query;

in response to determining that the user does not own the database catalog object represented by the respective row of the system metadata table, determining whether the user has access permission to the database catalog object represented by the respective row of the system metadata table;

in response to determining that the user has access permission to the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in the result set for the query; and

in response to determining that the user does not have access permission to the database catalog object represented by the respective row of the system metadata table, excluding the respective row of the system metadata table from the result set for the query; and

providing, to the user, the result set in response to the query.

11 . The system of claim 10 , wherein the system metadata table stores metadata about database catalog object types of tables, views, stored procedures, functions, or indices.

12 . The system of claim 10 , wherein the query is received from a process associated with the user.

13 . A non-transitory computer-readable storage medium storing instructions which when executed by one or more processors is configured to perform operations comprising:

receiving, from a user, a query that queries a system metadata table of a database system that includes database system metadata about database catalog objects created by users of the database system, wherein the system metadata table is created with a corresponding table definition defining columns included in the system metadata table and wherein the corresponding table definition includes column names of columns, data types of the column names, and length values indicating sizes of the data types;

processing rows of the system metadata table in response to the query, wherein processing a respective row of the rows of the system metadata table comprises:

determining a database catalog object represented by the respective row of the system metadata table;

determining if the user owns the database catalog object represented by the respective row of the system metadata table using table authorization information;

in response to determining that the user owns the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in a result set for the query;

in response to determining that the user does not own the database catalog object represented by the respective row of the system metadata table, determining whether the user has access permission to the database catalog object represented by the respective row of the system metadata table;

in response to determining that the user has access permission to the database catalog object represented by the respective row of the system metadata table, including the respective row of the system metadata table in the result set for the query; and

in response to determining that the user does not have access permission to the database catalog object represented by the respective row of the system metadata table, excluding the respective row of the system metadata table from the result set for the query; and

providing, to the user, the result set in response to the query.

14 . The computer-readable storage medium of claim 13 , wherein the system metadata table stores metadata about database catalog object types of tables, views, stored procedures, functions, or indices.